cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d

Analysis

max time kernel
162s
max time network
214s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
Size

139KB
MD5

0e9c8130006d051c003b9e1645942bec
SHA1

bc6acf4a3213186fbf5da2aa03af8eabf7d9a9ad
SHA256

cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d
SHA512

585da07035b0094fb870e89837c3f5292251029d17af3dd55fabde52f08e02b97d061fa40f9b58857c08d793cd87cfe66e0a9cc2ef09729ca17d4dadef4e8a46
SSDEEP

3072:/EMeZ+upo0psX0nVqVx2UuREoH8zYnBLN5Hj:6kF00gUx2DuoUYnBL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe"	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377211234"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001"	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e88dc27d0ad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006bd2ffe98bc444ca4fec9e49366f5c5000000000200000000001066000000010000200000002b628bc6f9eb790560505b7c32d058387300d0ff424324e6c278f2e72f8da15f000000000e80000000020000200000003646363bc73b974f1a8c05656f911ed2a3e2e228a2eb05dcfcec977b49db68d020000000ab8adb948d85c91c041b1345c48a53896d7ccada381b3551a8a53557e1fa91cf400000006234b250270ac0d946e24a9c5a3f9830fdb3f4eb79720f0146aa0dba4c7b67452bdca8e02785afaef1516cb29fa7a61bc6a6de27d5e1afccb37bee3d17f2d7bd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006bd2ffe98bc444ca4fec9e49366f5c50000000002000000000010660000000100002000000063958065e8a3fd2601cb73f4db11517889fa53b7ad5c97e16b02744284105de9000000000e800000000200002000000016996b54b2b68677ef0d9820108d6eabefc819e3091803a74f9b7ee8013e051d90000000d0e76c9ef70ca15569796ee8b577165231f47a36f02ff11cef487ee6e0f7a70f92b08affa1317ab1b484c82dea152ee0cb1fbb24f08afaaa9446f268323f81f2d2ea9da495226dcad53201cef4ded64474b782c2a157a97bafc9a6dac289d56f2aff35dec5a062ec0ca919a07034ddad21bf2f05b1e2a0d8e2ec736c64a5d3b3d56d80d90cbaa92c9b93e03bf839fd7d40000000e6aaef9c49d67835f4fd2dfa8d7a4dc8f73c64dcfb0f5f3e61aa30afffd022c16a0039141c60c1a0b1669a1aba0fb2b9b3d9324e445a4b025a6eb78a53b9ced0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D1D47D61-7670-11ED-9AAE-C6457FCBF3CF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1500	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1752	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
1500	iexplore.exe
1500	iexplore.exe
780	IEXPLORE.EXE
780	IEXPLORE.EXE
780	IEXPLORE.EXE
780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1500	1752	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe	28
PID 1752 wrote to memory of 1500	1752	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe	28
PID 1752 wrote to memory of 1500	1752	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe	28
PID 1752 wrote to memory of 1500	1752	cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe	28
PID 1500 wrote to memory of 780	1500	iexplore.exe	30
PID 1500 wrote to memory of 780	1500	iexplore.exe	30
PID 1500 wrote to memory of 780	1500	iexplore.exe	30
PID 1500 wrote to memory of 780	1500	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe
"C:\Users\Admin\AppData\Local\Temp\cf083bd90a42a5605655d61033a70692e923e74d4fa02db007de6ec29b0b120d.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=gOO_UqzEc5Y
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
c2fb5c6e298c7e5cac8dab1a51544acb

SHA1
f63aba5f884f68a4c1f77f7d99a0c8684baa36dd

SHA256
96e57afd6c66ff3e512b26d9620d5812396434954b91da27b9c1db4d42bf308f

SHA512
dd02a15705541a234a2a9b2a426f25521d520389954949a5a5a01dd52496626806fcb17c9d173b780d1aa3b6955db29cc1f22ef0ec681d138a7f6c5eddd4efea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
5KB

MD5
4f7a7ff4ec1c83a28ef77f49d317abab

SHA1
f75259c0d4a730275ad7b6be3f21fb4bd7404b4d

SHA256
df524e2e59e9a55ab09b8d8f43c533c765de947bfae5ba1a4b61a3cfe03c6078

SHA512
cd096bcd062a56585a2238546b534372063c7d3fcdb8058f6d2b62b761c262b43287d0cf80c37d655a13357a64b8b852db783e7b83aec668efb84130e869b849

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MM0HEVBT.txt

Filesize
600B

MD5
160b06089977c99f1c105c5020c156c5

SHA1
9cbe51442a38cfdc8c6135855089129847b93f3c

SHA256
f404541b9727c2e494ad4fc1a0102e48ca28da651287a7f1ef569c49469b5226

SHA512
d700fd15d65bff31d73fa2f45f7f58c1a1935551da479b8625802ca7c5448300dcc41a10a8bb0a034c7904352603d0775272a0ae3d7f9a792d6fbf0ebd2cd8bb

Download Submit
memory/1752-54-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1752-55-0x00000000002F0000-0x0000000000336000-memory.dmp

Filesize
280KB

Download
memory/1752-58-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1752-60-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1752-61-0x00000000002F0000-0x0000000000336000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads